Make PasswordEvidence implementation FIPS compliant

XMLWordPrintableJSON

    • Type: Improvement
    • Resolution: Fixed
    • Priority: Major - P3
    • 2.6.0
    • Affects Version/s: 2.5
    • Component/s: Security
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      The implementation of PasswordEvidence uses SHA256Managed and SHA256Managed is not FIPS compliant.

      In fact, PasswordEvidence doesn't need to use SHA256 at all. It is only used as an optimization for the Equals method, to avoid having to decrypt the SecureString to compare two passwords.

      Equals should be implemented in such a way that two PasswordEvidence instances can be compared without using a non-FIPS compliant method.

              Assignee:
              Robert Stam
              Reporter:
              Robert Stam
              Votes:
              1 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: